CVE-2026-45618: 
JavaScript vulnerability analysis and mitigation

CVE-2026-45618 is a critical Remote Code Execution (RCE) vulnerability in LiquidJS, a popular Liquid template engine for JavaScript/Node.js. It affects all versions of the liquidjs npm package prior to 10.26.0 and allows unauthenticated attackers to execute arbitrary code by submitting crafted templates. The vulnerability was published by maintainer harttle on May 24, 2026, and added to the GitHub Advisory Database on May 27, 2026. It carries a CVSS v3.1 base score of 10.0 (Critical) (GitHub Advisory, LiquidJS Advisory).

The root cause is improper control of code generation (CWE-94), arising from two chained weaknesses in LiquidJS's filter evaluation logic. First, the built-in valueOf filter returns this (the internal rendering context object) when applied to a primitive value (e.g., 1|valueOf), exposing the engine's internal state — including the parser, loader, filesystem module, and filter registry — to template-level access. Second, the comparable gadget (used by comparison operators like ==) allows calling arbitrary functions with attacker-controlled arguments. By chaining these primitives, an attacker can overwrite this.loader.lookup and this.readFile on the parser, gain a reference to the JavaScript Function constructor, and ultimately execute arbitrary code. A full public PoC is included in the advisory, demonstrating execution of child_process.execSync('sh', {stdio:'inherit'}) (GitHub Advisory, LiquidJS Advisory).

Successful exploitation grants an attacker full remote code execution on the host running the LiquidJS engine, with no authentication or user interaction required. The scope is marked as Changed, meaning the impact extends beyond the vulnerable component itself — an attacker can read sensitive files (e.g., /etc/passwd), spawn interactive shells, exfiltrate data, install backdoors, or pivot laterally within the network. Confidentiality, integrity, and availability are all fully compromised (GitHub Advisory, Orca Security).

A detailed, functional proof-of-concept exploit is publicly available in the GitHub Security Advisory, lowering the bar for exploitation significantly (LiquidJS Advisory). As of the time of disclosure, there is no confirmed evidence of in-the-wild exploitation or threat actor attribution. The vulnerability requires no privileges and no user interaction, making it trivially exploitable against any application that renders attacker-controlled templates using a vulnerable LiquidJS version. The CVE status is listed as Reserved, and no EPSS score or CISA KEV catalog entry has been reported (GitHub Advisory).

1. Identify target: Locate applications that use the liquidjs npm package (versions < 10.26.0) and accept user-supplied template input for rendering — common in CMS platforms, email templating systems, or report generators.
2. Obtain internal context reference: Craft a template using 1|valueOf to obtain a reference to this (the internal LiquidJS rendering context), which exposes the parser, loader, filesystem module, and filter registry:

   {% assign r = 1|valueOf %}
   {% assign m = r.context.scopes|first %}

3. Extract internal functions via comparable gadget: Use the group_by/where filter chain to extract references to internal functions (e.g., p.parseFile, f.raw.handler) and assign them to comparison operator slots (equals, gt, geq, etc.).
4. Overwrite prototype and loader: Use {% assign __proto__ = p %} and related assignments to overwrite this.loader.lookup and this.readFile on the parser object, gaining control over what is passed to this.parse.
5. Obtain Function constructor: Assign a function to filters, then use the comparable gadget to call filters['constructor'], yielding a reference to the JavaScript Function constructor.
6. Execute arbitrary code: Use the Function constructor reference to create and invoke a function with arbitrary JavaScript, e.g.:

   {% assign RCE = m == "return process.getBuiltinModule('child_process').execSync('sh',{stdio:'inherit'})" %}
   {{RCE}}

   This spawns an interactive shell as the Node.js process user (LiquidJS Advisory, GitHub Advisory).

• Logs: Application logs showing template input containing valueOf, group_by, __proto__, constructor, child_process, or execSync keywords; unexpected errors from the LiquidJS parser related to prototype manipulation.
• Process: Unusual child processes spawned by the Node.js application process (e.g., sh, bash, curl, wget, python, nc); interactive shell sessions originating from the web application process.
• Network: Outbound connections from the Node.js server to unexpected external IPs or domains, particularly on non-standard ports; reverse shell traffic patterns.
• File System: New or modified files in the application directory or /tmp; presence of web shells, cron jobs, or SSH authorized keys added by the application user account.
• Application Behavior: Unexpected template rendering errors or timeouts; application crashes or restarts following submission of complex template payloads (LiquidJS Advisory, Orca Security).

Upgrade the liquidjs npm package to version 10.26.0 or later, which blocks Object.prototype filter/tag lookups that enable this exploit chain (commit 457fae0, PR #897) (LiquidJS Release). If an immediate upgrade is not possible, implement network-level controls to restrict which users or systems can submit template content, and consider disabling user-supplied template rendering entirely until patched. Applications should also validate and sanitize all template input to reject suspicious keywords such as valueOf, __proto__, constructor, and child_process as a defense-in-depth measure (GitHub Advisory).

Orca Security published a technical blog post analyzing the vulnerability and confirming the RCE impact on unpatched hosts (Orca Security). The Centre for Cybersecurity Belgium (CCB) issued a warning advisory urging immediate patching (CCB Advisory). Security news outlet SecurityOnline.info also covered the vulnerability, and it was picked up by aggregators including Vulners and CyberSecBrief, reflecting broad community awareness of the critical severity rating.